Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    33s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2024, 12:52

General

  • Target

    fpsbooster.exe

  • Size

    10.6MB

  • MD5

    ae8472fb1d1cd4b552e713c496a8ea5c

  • SHA1

    974a150578fe2879b9f16c50d8c6ce722457d440

  • SHA256

    bb7bfe39f1aa1ec4ef6463630c97d5186de1a4593488f11f2ed2498b5a3f7597

  • SHA512

    f725e799abe0cf0f6a21968d06259f44f2efdfb170e1c59e06cc51806c7ecbf8d42c237ac693e5d03d67ab545dc8eab90835e753968d4559b792c297026f1fed

  • SSDEEP

    196608:kzEkobwrHLDuWJysVYvsOIroyMxxvjDDAxlfe6df/dHzmHZ3v9oxXTya+BuGPlsh:mEkomHmWJZoyMxtDDAxlfxdf/dHWZ3lO

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 41 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fpsbooster.exe
    "C:\Users\Admin\AppData\Local\Temp\fpsbooster.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\Users\Admin\AppData\Local\Temp\fpsbooster.exe
      "C:\Users\Admin\AppData\Local\Temp\fpsbooster.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Windows\system32\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\Crypto\Cipher\_raw_cbc.pyd

    Filesize

    12KB

    MD5

    20708935fdd89b3eddeea27d4d0ea52a

    SHA1

    85a9fe2c7c5d97fd02b47327e431d88a1dc865f7

    SHA256

    11dd1b49f70db23617e84e08e709d4a9c86759d911a24ebddfb91c414cc7f375

    SHA512

    f28c31b425dc38b5e9ad87b95e8071997e4a6f444608e57867016178cd0ca3e9f73a4b7f2a0a704e45f75b7dcff54490510c6bf8461f3261f676e9294506d09b

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\Crypto\Cipher\_raw_cfb.pyd

    Filesize

    13KB

    MD5

    43bbe5d04460bd5847000804234321a6

    SHA1

    3cae8c4982bbd73af26eb8c6413671425828dbb7

    SHA256

    faa41385d0db8d4ee2ee74ee540bc879cf2e884bee87655ff3c89c8c517eed45

    SHA512

    dbc60f1d11d63bebbab3c742fb827efbde6dff3c563ae1703892d5643d5906751db3815b97cbfb7da5fcd306017e4a1cdcc0cdd0e61adf20e0816f9c88fe2c9b

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\Crypto\Cipher\_raw_ctr.pyd

    Filesize

    14KB

    MD5

    c6b20332b4814799e643badffd8df2cd

    SHA1

    e7da1c1f09f6ec9a84af0ab0616afea55a58e984

    SHA256

    61c7a532e108f67874ef2e17244358df19158f6142680f5b21032ba4889ac5d8

    SHA512

    d50c7f67d2dfb268ad4cf18e16159604b6e8a50ea4f0c9137e26619fd7835faad323b5f6a2b8e3ec1c023e0678bcbe5d0f867cd711c5cd405bd207212228b2b4

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\Crypto\Cipher\_raw_ecb.pyd

    Filesize

    10KB

    MD5

    fee13d4fb947835dbb62aca7eaff44ef

    SHA1

    7cc088ab68f90c563d1fe22d5e3c3f9e414efc04

    SHA256

    3e0d07bbf93e0748b42b1c2550f48f0d81597486038c22548224584ae178a543

    SHA512

    dea92f935bc710df6866e89cc6eb5b53fc7adf0f14f3d381b89d7869590a1b0b1f98f347664f7a19c6078e7aa3eb0f773ffcb711cc4275d0ecd54030d6cf5cb2

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\Crypto\Cipher\_raw_ofb.pyd

    Filesize

    12KB

    MD5

    4d9182783ef19411ebd9f1f864a2ef2f

    SHA1

    ddc9f878b88e7b51b5f68a3f99a0857e362b0361

    SHA256

    c9f4c5ffcdd4f8814f8c07ce532a164ab699ae8cde737df02d6ecd7b5dd52dbd

    SHA512

    8f983984f0594c2cac447e9d75b86d6ec08ed1c789958afa835b0d1239fd4d7ebe16408d080e7fce17c379954609a93fc730b11be6f4a024e7d13d042b27f185

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\Crypto\Util\_strxor.pyd

    Filesize

    10KB

    MD5

    8f4313755f65509357e281744941bd36

    SHA1

    2aaf3f89e56ec6731b2a5fa40a2fe69b751eafc0

    SHA256

    70d90ddf87a9608699be6bbedf89ad469632fd0adc20a69da07618596d443639

    SHA512

    fed2b1007e31d73f18605fb164fee5b46034155ab5bb7fe9b255241cfa75ff0e39749200eb47a9ab1380d9f36f51afba45490979ab7d112f4d673a0c67899ef4

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\VCRUNTIME140.dll

    Filesize

    87KB

    MD5

    0e675d4a7a5b7ccd69013386793f68eb

    SHA1

    6e5821ddd8fea6681bda4448816f39984a33596b

    SHA256

    bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

    SHA512

    cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\VCRUNTIME140_1.dll

    Filesize

    48KB

    MD5

    eb49c1d33b41eb49dfed58aafa9b9a8f

    SHA1

    61786eb9f3f996d85a5f5eea4c555093dd0daab6

    SHA256

    6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e

    SHA512

    d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_asyncio.pyd

    Filesize

    62KB

    MD5

    fe9322e00324b59c179d4c9803322b6c

    SHA1

    4d27aa7b1d38ee633de49256bb26a9ee47eb9ef1

    SHA256

    46967e4ef54e222dcda43b64032a3f22ed9fce4cebbe0e64288ed80f86a500eb

    SHA512

    29d65bd6e81325cb17ef105a2e4bf3b65c859389da1bd98036227b45bd4496c31aec6427df5fbd7dc9bec482b18d1481abcb7cbfe34dce7229b4a33b971219b8

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_bz2.pyd

    Filesize

    82KB

    MD5

    3dc8af67e6ee06af9eec52fe985a7633

    SHA1

    1451b8c598348a0c0e50afc0ec91513c46fe3af6

    SHA256

    c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929

    SHA512

    da16bfbc66c8abc078278d4d3ce1595a54c9ef43ae8837ceb35ae2f4757b930fe55e258827036eba8218315c10af5928e30cb22c60ff69159c8fe76327280087

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_cffi_backend.cp38-win_amd64.pyd

    Filesize

    177KB

    MD5

    77b5d28b725596b08d4393786d98bd27

    SHA1

    e3f00478de1d28bc7d2e9f0b552778be3e32d43b

    SHA256

    f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c

    SHA512

    d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_ctypes.pyd

    Filesize

    120KB

    MD5

    f1e33a8f6f91c2ed93dc5049dd50d7b8

    SHA1

    23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4

    SHA256

    9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4

    SHA512

    229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_decimal.pyd

    Filesize

    261KB

    MD5

    17ca59b401eefd4ab19991f1863fb556

    SHA1

    5b5b7007edf58fd2af41630ea3dd7ae7a98dd6f2

    SHA256

    7b3fab77197e0a4ed13642f462343ae34c0688156f0665d18f514c61a327b033

    SHA512

    e04be5c17ca717d3d769bac5a21eb3126af0571301003f847557bc21baf3ee470fd6c968f618123a0e2f27b642f52a756d68e5ed429eada16ce9ef9b6f5a5639

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_hashlib.pyd

    Filesize

    44KB

    MD5

    a6448bc5e5da21a222de164823add45c

    SHA1

    6c26eb949d7eb97d19e42559b2e3713d7629f2f9

    SHA256

    3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a

    SHA512

    a3833c7e1cf0e4d181ac4de95c5dfa685cf528dc39010bf0ac82864953106213eccff70785021ccb05395b5cf0dcb89404394327cd7e69f820d14dfa6fba8cba

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_lzma.pyd

    Filesize

    246KB

    MD5

    37057c92f50391d0751f2c1d7ad25b02

    SHA1

    a43c6835b11621663fa251da421be58d143d2afb

    SHA256

    9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764

    SHA512

    953dc856ad00c3aec6aeab3afa2deb24211b5b791c184598a2573b444761db2d4d770b8b807ebba00ee18725ff83157ec5fa2e3591a7756eb718eba282491c7c

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_multiprocessing.pyd

    Filesize

    28KB

    MD5

    9b1c3fdf64e5e642cec1a82ac76f8184

    SHA1

    a104fc78d15a263319ed003517e6929e193455de

    SHA256

    4aff330cafb4b497cb45a91a2e9e8a64b44f998f582dd795b3df58963d5f76f2

    SHA512

    173e39901e876cc34b44fbe5ed3f3cab170dc007fcbf93c21cc76b684323d83cc6ef6158587d4ab2d7127e881ff4fd98f92d909f2c4a897c153b69b9ed5804ae

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_overlapped.pyd

    Filesize

    44KB

    MD5

    1b04bd84bdd90b8419e2a658a1cacc6e

    SHA1

    c016487aa0455a8bb664f306fb4ad3e7e64811f2

    SHA256

    44f9ed9d97881b29ecc79a2b3077760a4f9f7b5ba386751c0f3b98f1bfb0d8c4

    SHA512

    24e86b3325d00484dd5da6198bd5e935fed0b31c4d1fba8d41340d39863e1e47c499899ca82bf477a007f6a636cf296702ece9b457a43a4aaec6b38569cfa2e3

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_queue.pyd

    Filesize

    27KB

    MD5

    44b72e0ad8d1e1ec3d8722088b48c3c5

    SHA1

    e0f41bf85978dd8f5abb0112c26322b72c0d7770

    SHA256

    4aa1bbde1621c49edab4376cf9a13c1aa00a9b0a9905d9640a2694ef92f77d5e

    SHA512

    05853f93c6d79d8f9c96519ce4c195b9204df1255b01329deaa65e29bd3e988d41454cd305e2199404f587e855737879c330638f2f07bff11388a49e67ba896c

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_socket.pyd

    Filesize

    77KB

    MD5

    d6bae4b430f349ab42553dc738699f0e

    SHA1

    7e5efc958e189c117eccef39ec16ebf00e7645a9

    SHA256

    587c4f3092b5f3e34f6b1e927ecc7127b3fe2f7fa84e8a3d0c41828583bd5cef

    SHA512

    a8f8fed5ea88e8177e291b708e44b763d105907e9f8c9e046c4eebb8684a1778383d1fba6a5fa863ca37c42fd58ed977e9bb3a6b12c5b8d9ab6ef44de75e3d1e

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_sqlite3.pyd

    Filesize

    85KB

    MD5

    d2e7ccc8bd1aba0b268ee72577548bcd

    SHA1

    f7a1d15d23348e4d7f1c94769c84923e94d16ac6

    SHA256

    75db26ab9dc51d765d1d98dca63f57a801796ee19fdb87e62be518937584015f

    SHA512

    61d7445d007a176d6a202971d608031cbdf0e1a31fc4be67e85181d3247934f90f24c1954710ecf9c135e90326171bfd210b3f30f22332a7ee898ce5f8e08dc9

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\_ssl.pyd

    Filesize

    115KB

    MD5

    8ee827f2fe931163f078acdc97107b64

    SHA1

    149bb536f3492bc59bd7071a3da7d1f974860641

    SHA256

    eaeefa6722c45e486f48a67ba18b4abb3ff0c29e5b30c23445c29a4d0b1cd3e4

    SHA512

    a6d24e72bf620ef695f08f5ffde70ef93f42a3fa60f7c76eb0f521393c595717e05ccb7a61ae216c18fe41e95fb238d82637714cf5208ee8f1dd32ae405b5565

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\base_library.zip

    Filesize

    821KB

    MD5

    b0eff6c61421d23055a49a14bd50bee5

    SHA1

    9c5070e50d7b8766a637c426f6a0b8cb43644dfe

    SHA256

    dc132bab6aa45b35dd7f8a77e1f7ecf04ede46fdbee43ce49e6a312002a8220d

    SHA512

    5bfdc0f0fc1c269ab2fdb18f3b4d6732fa7dfa3fa83e27e962a0151706a66ddb8439eb5f63367e0b2d0e896333c03d3e79ad8f60aca4ca72a2460e8d4cddb990

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\charset_normalizer\md.cp38-win_amd64.pyd

    Filesize

    10KB

    MD5

    38105df780eddd734027328e0dca0ca3

    SHA1

    45f1d9e3472478f8e1ba86675f5c81c00b183bea

    SHA256

    9512896233d2119e78e2e1fcfd83643b2be2b427f08d16fc568fe98b9d4913cb

    SHA512

    ba2a05c236ce47d87888f618be2b23532d0d882578707b07ae220a96883b468f7088a19ebbe3bac2adf4035da6b7ee6fa9e57b620e2bc67b28e54cd969d6bbb3

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

    Filesize

    116KB

    MD5

    073f09e1edf5ec4173ce2de1121b9dd1

    SHA1

    6cdb2559a1b706446cdd993e6fd680095e119b2e

    SHA256

    7412969bfe1bca38bbb25bab02b54506a05015a4944b54953fcfdb179ec3f13c

    SHA512

    70a1a766001ec78a5fce7eadf6cae07f11b3ca6b08115e130c77d024524879577ccab263c596102102b1569933c601592fbb5ee07c7db123bb850965ef8e8e96

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\libcrypto-1_1.dll

    Filesize

    3.2MB

    MD5

    bf83f8ad60cb9db462ce62c73208a30d

    SHA1

    f1bc7dbc1e5b00426a51878719196d78981674c4

    SHA256

    012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d

    SHA512

    ae1bdda1c174ddf4205ab19a25737fe523dca6a9a339030cd8a95674c243d0011121067c007be56def4eaeffc40cbdadfdcbd1e61df3404d6a3921d196dcd81e

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\libffi-7.dll

    Filesize

    32KB

    MD5

    4424baf6ed5340df85482fa82b857b03

    SHA1

    181b641bf21c810a486f855864cd4b8967c24c44

    SHA256

    8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79

    SHA512

    8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\libssl-1_1.dll

    Filesize

    670KB

    MD5

    fe1f3632af98e7b7a2799e3973ba03cf

    SHA1

    353c7382e2de3ccdd2a4911e9e158e7c78648496

    SHA256

    1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b

    SHA512

    a0123dfe324d3ebf68a44afafca7c6f33d918716f29b063c72c4a8bd2006b81faea6848f4f2423778d57296d7bf4f99a3638fc87b37520f0dcbeefa3a2343de0

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\pyexpat.pyd

    Filesize

    185KB

    MD5

    e684792507faf113474a6d1217aeeaad

    SHA1

    f9486048ec025a9f469f52c1788a74e70975b431

    SHA256

    1035c85c840c1007d5f5bb62ca7358d6c85b5e4bf15155fe0857c6a17453f18a

    SHA512

    1a50bc231963d405f25879ee3560eb90f7b18d51640b9b4d848f18caa9fef14907f8935a86f093478be0ee0e1261e4bcc8c697b486bc0617c5f77370337d48c3

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\python3.dll

    Filesize

    57KB

    MD5

    7acec875d5672e7aa148b8c40df9aa49

    SHA1

    96b8cfabe0cfa3df32995919ac77cfdeec26f1f2

    SHA256

    d96858e433f45917499dbf5e052e56f079ff9ae259fd3caa025c3b1daf852891

    SHA512

    1208da62fe82b779ec822ad702f9ca4321b34ee590c28e10efe9a2db6d582bfdcae01ab2431c1a98714ef0c60434d64c58f3db31bf5886efbb943adc70d6e975

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\python38.dll

    Filesize

    4.0MB

    MD5

    d2a8a5e7380d5f4716016777818a32c5

    SHA1

    fb12f31d1d0758fe3e056875461186056121ed0c

    SHA256

    59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9

    SHA512

    ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\select.pyd

    Filesize

    26KB

    MD5

    6ae54d103866aad6f58e119d27552131

    SHA1

    bc53a92a7667fd922ce29e98dfcf5f08f798a3d2

    SHA256

    63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88

    SHA512

    ff23f3196a10892ea22b28ae929330c8b08ab64909937609b7af7bfb1623cd2f02a041fd9fab24e4bc1754276bdafd02d832c2f642c8ecdcb233f639bdf66dd0

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\sqlite3.dll

    Filesize

    1.2MB

    MD5

    6695408dcb79890ed16b7491ba07ea3b

    SHA1

    07fdf0d4d167b5893853b71c54df1dce313503ad

    SHA256

    f2e7a0cbfaaaa597d68b923a5360669ab3cd9e643fabdab2aba7c6da91f2b5cb

    SHA512

    12c04eae6771c6a7878034b40deb19c843cfa0438c20fdd5099195d8e12ba9bc64fdc7e367353b08a2ff0788c67eb8b16521918df5a1e133863a44f02de01818

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\unicodedata.pyd

    Filesize

    1.0MB

    MD5

    4c0d43f1a31e76255cb592bb616683e7

    SHA1

    0a9f3d77a6e064baebacacc780701117f09169ad

    SHA256

    0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8

    SHA512

    b8176a180a441fe402e86f055aa5503356e7f49e984d70ab1060dee4f5f17fcec9c01f75bbff75ce5f4ef212677a6525804be53646cc0d7817b6ed5fd83fd778

  • C:\Users\Admin\AppData\Local\Temp\_MEI42162\zstandard\backend_c.cp38-win_amd64.pyd

    Filesize

    513KB

    MD5

    a72ac2744631c74b0f2a6b58f255b5f3

    SHA1

    841dcc524c72a9fffca11187bd0fe67c91ac641d

    SHA256

    8e520d0ed8ecc19424b044544d620e670a8f659bf41f9f0a01789451bb6034b4

    SHA512

    21669b710ab8a4584823953426795109d716a47042dd67835d9eb4f0abb216733e2904313fb280a08bf92fcb3e04f84ef04ead5b3cb770473f13febf0a9881e0

  • C:\Users\Admin\AppData\Local\Temp\crcook.txt

    Filesize

    29B

    MD5

    155ea3c94a04ceab8bd7480f9205257d

    SHA1

    b46bbbb64b3df5322dd81613e7fa14426816b1c1

    SHA256

    445e2bcecaa0d8d427b87e17e7e53581d172af1b9674cf1a33dbe1014732108b

    SHA512

    3d47449da7c91fe279217a946d2f86e5d95d396f53b55607ec8aca7e9aa545cfaf9cb97914b643a5d8a91944570f9237e18eecec0f1526735be6ceee45ecba05